OSVDB ID: 22754 Title: Cisco VPN 3000 Concentrator Crafted HTTP Packet DoS |
Info |
|
|
Dates |
||||
|
|
Description |
Cisco VPN Conentrator 3000 contains a flaw that may allow a remote denial of service. The issue is triggered when a specially crafted HTTP packet is sent to the service, which will lead to the device being rebooted. This will result in loss of availability for the platform. |
Classification |
Location:
Remote / Network Access
Attack Type: Denial of Service Impact: Loss of Availability Solution: Upgrade Exploit: Exploit Unknown Disclosure: OSVDB Verified, Vendor Verified |
Solution |
Cisco recommends customers upgrade to version 4.7.2.B or higher to fix this vulnerability. However, additional testing by Eldon Sprickerhoff indicates this firmware revision is vulnerable as well. As a workaround, administrators can disable the HTTP service, which is enabled by default. |
Products |
|
References |
|
Credit |
|
eSentire.com - eSentire, Inc